CISA has added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog, while Alpine Linux has disclosed that an attacker tried to exploit the same GitLab flaw against its self-hosted development server on October 20 and 21. The attempts crashed GitLab worker processes eight times, but Alpine says it found no evidence that the attacker executed code and cannot rule out that possibility.
The vulnerability is an integer overflow in GitLab’s CI/CD regular-expression compiler. Under certain conditions, a specially crafted pattern could allow an unauthenticated user to execute code on a vulnerable server. GitLab assigned CVE-2026-97229 a CVSS score of 10.0 and fixed it in its October 12 patch release, with versions 19.4.2, 19.3.5 and 19.2.8. CISA added it to the KEV catalog on October 29, giving U.S. federal civilian agencies until November 1 to remediate it. The listing does not name a victim or say whether it is connected to Alpine’s incident. The flaw is separate from another critical regular-expression compiler vulnerability, CVE-2026-110264, which GitLab fixed in later October releases.
In its incident report, Alpine said a newly registered account sent crafted CI configurations to its GitLab server, which was still running version 19.3.4. The requests crashed worker processes eight times, and in four of those cases the attacker got partway through the exploit before failing at the next step. The attacker also downloaded Alpine’s GitLab container image, which the project believes may have been used to tune the exploit to its specific build. Alpine found no evidence that code ran on the server, but some logs from the attack period were missing and the host did not record outbound network connections.
The incident exposed a gap that can affect custom GitLab installations. Alpine upgraded to GitLab 19.3.6 on October 22, but the change did not remove the vulnerability because its container used the standard Ruby runtime rather than the patched Ruby bundled with GitLab’s official packages. The underlying flaw is in Ruby’s Onigmo regular-expression engine. The Ruby project released fixes on October 23 in versions 3.3.13, 3.4.12 and 4.0.9. Administrators running GitLab from source or in custom images need to update the Ruby runtime as well as GitLab itself.
Alpine treated its GitLab instance as compromised and rebuilt it from scratch, reset all account passwords and replaced GitLab secret keys. The project said its source repository, packages and October 21 stable releases were checked against records outside GitLab and showed no signs of tampering. Alpine also said the keys used to sign its packages and releases had never been stored on the affected GitLab server.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
